This is not about storing state, but using cookies to track users across domains in order to build up a profile about the user. It is only the latter that needs explicit permission under the new law.
Of course, phrasing new regulations to cover only that specific application of cookies while allowing any other legitimate or future uses is going to be interesting. And by interesting I mean pretty much impossible.
